+- Sinisterly (https://sinister.ly)
+-- Forum: General (https://sinister.ly/Forum-General)
+--- Forum: Announcements (https://sinister.ly/Forum-Announcements)
+---- Forum: Announcements (Archived) (https://sinister.ly/Forum-Announcements-Archived)
+---- Thread: Security Breach (/Thread-Security-Breach)
RE: Security Breach - The Toilet Paper King - 01-01-2015
(01-01-2015, 06:04 PM)Oni Wrote: His statement is too broad. He's insinuating that all of the recent security breaches are due to a CSRF and lack of discretion when it comes to login details. That, of course, isn't the case for us. The vulnerability that allowed the attacker to spawn a shell, was in the admin panel (but wasn't a CSRF). Credentials weren't gained through me or clicking of an unsafe link, either.
It might have been broad - but your response was just as broad and suggests that there is no low-risk CSRF vulnerability as he stated.
Also, we are just supposed to take your word that you didn't do a dumbass thing like click on a malicious link? Past experience shows you aren't exactly the brightest bulb in the pack.
(01-01-2015, 06:04 PM)Oni Wrote: But hey, you have no experience at all - so I wouldn't take much from your statement either.
You have no idea what my experience is. But I can tell you that I have enough experience to know that leaving the administration panel at /admin is dumb as fuck. So is not keeping regular offsite backups.
You clearly don't even have that basic administration knowledge.
RE: Security Breach - Dyme - 01-01-2015
Can we just disclose everything? Who hacked the site? How was the shell spawned via the ACP? If the attacker really wanted "fame" or credit for the hack, he would have publicly taken responsibility for it already. This information would clear up a lot of things and better help other forums to protect themselves from being compromised as well.
RE: Security Breach - Ominous - 01-01-2015
(01-01-2015, 08:35 PM)Dyme Wrote: Can we just disclose everything? Who hacked the site? How was the shell spawned via the ACP? If the attacker really wanted "fame" or credit for the hack, he would have publicly taken responsibility for it already. This information would clear up a lot of things and better help other forums to protect themselves from being compromised as well.
As far as I know there are many public exploits in the ACP that haven't been patched yet, and that's how the shell was spawned. What I'm more interested in is how the attacker got into the ACP in the first place, and who did it.
I agree with Oni that what Omni wrote doesn't seem to fit in with the method SL was compromised. There's either another vulnerability, or he's leaving out something.
RE: Security Breach - Oni - 01-02-2015
(01-01-2015, 06:45 PM)The Toilet Paper King Wrote: It might have been broad - but your response was just as broad and suggests that there is no low-risk CSRF vulnerability as he stated.
Also, we are just supposed to take your word that you didn't do a dumbass thing like click on a malicious link? Past experience shows you aren't exactly the brightest bulb in the pack.
You have no idea what my experience is. But I can tell you that I have enough experience to know that leaving the administration panel at /admin is dumb as fuck. So is not keeping regular offsite backups.
You clearly don't even have that basic administration knowledge.
Offsite backups and an alternate admin path have been a thing, prior to your registration, even. Enjoy the permanent ban.
RE: Security Breach - Uzinero - 01-02-2015
(01-02-2015, 07:47 AM)Oni Wrote: Offsite backups and an alternate admin path have been a thing, prior to your registration, even. Enjoy the permanent ban.
KEK, seriously, not having the admin panel at /admin is something SL has done for ages, surprised anyone doesn't know about it. Back in the SL skype chat in around May '14 (holy shit, almost a year...That's gone fast.) it was spread around a lot because sinister.ly/admin redirected to a page with "How about I slap your shit?" with some weird dancing thingy (I don't remember it fully.) Found it quite funny in all honesty, seeing how much Shitwipe insulted you when he clearly didn't know fuck about the forum's security.
Also, the site seemed to be off for me for a few hours today. Like it was online, but SL was nothing but a blank page, is this something to do with the security breach or was it too do with maintenance or something?
RE: Security Breach - Oni - 01-02-2015
(01-02-2015, 10:48 PM)Uzinero Wrote: KEK, seriously, not having the admin panel at /admin is something SL has done for ages, surprised anyone doesn't know about it. Back in the SL skype chat in around May '14 (holy shit, almost a year...That's gone fast.) it was spread around a lot because sinister.ly/admin redirected to a page with "How about I slap your shit?" with some weird dancing thingy (I don't remember it fully.) Found it quite funny in all honesty, seeing how much Shitwipe insulted you when he clearly didn't know fuck about the forum's security.
Also, the site seemed to be off for me for a few hours today. Like it was online, but SL was nothing but a blank page, is this something to do with the security breach or was it too do with maintenance or something?
I'll just say that the MyBB upgrade script broke things and leave it at that.
RE: Security Breach - Master - 01-03-2015
(01-02-2015, 10:48 PM)Uzinero Wrote: Also, the site seemed to be off for me for a few hours today. Like it was online, but SL was nothing but a blank page, is this something to do with the security breach or was it too do with maintenance or something?
Same here! I was wondering if there is any where to go (like twitter or facebook page) to see latest developments, if the main site stop working? I have seen many twitter account with connection to sinister.ly (few listed below) but latest tweets are from months a go.
https://twitter.com/sinister_ly
https://twitter.com/beingsinister
https://twitter.com/oni_sensei
where is the official one if any?
RE: Security Breach - Kizaru - 01-03-2015
it it was definitely a csrf about 94% sure
RE: Security Breach - Arthur Curry - 01-03-2015
(01-03-2015, 05:31 AM)Yagmi Wrote: it it was definitely a csrf about 94% 100% sure
Agreed. Nothing else makes much sense.
RE: Security Breach - phyrrus9 - 01-03-2015
Nothing has to make sense. It wasn't a csrf. As far as a twitter goes I don't believe there is one, but you can always follow me and I will put updates, or you can be part of the Skype group.